Role management

[Peter Schober]

* Ramaiah, Vanna G. <ramaiah at musc.edu> [2016-09-01 17:00]:
> This is not really a shib question but thought of asking in this
> group as the vendor would like to shib sign on. 
> In our org, an user can have  upto 3 roles but just one login for
> authentication. We have a vendor that cannot handle all 3 roles in
> one login. Any idea how can I implement this one? Can shib release
> data on the fly?

Grasping at straws: If only one of those roles is relevant for the SP
in question (and it's the same for everyone) you could suppress the
release of any other role values to that SP:
https://wiki.shibboleth.net/confluence/display/IDP30/ValueConfiguration
https://wiki.shibboleth.net/confluence/display/IDP30/ValueRegexConfiguration

If it's not static you could certainly script it:
https://wiki.shibboleth.net/confluence/display/IDP30/ScriptConfiguration

That would allow you to e.g.:
* pick/refer relevant role values over others, making sure only one
  get's released, or
* pick any value (relying on order, or randomly), making sure only one
  get's released.

-peter